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APPARATUS AND METHOD FOR DISABLING 
THE OPERATION OF HIGH POWER DEVICES 

CROSS-REFERENCE TO RELATED APPLICATIONS 

STATEMENT REGARDING FEDERALLY 
SPONSORED RESEARCH OR DEVELOPMENT 

FIELD OF THE INVENTION 
[0001] The present invention relates to drive circuits that are used to control the 
delivery of high power levels to high power loads such as motors and, more particularly, 
to the disabling of the power delivered by of such drive circuits so that the loads are no 
longer driven. 

BACKGROUND OF THE INVENTION 
[0002] High power devices are commonly employed in a variety of environments 
including, for example, industrial facilities and construction environments. High power 
devices generally include a variety of different devices including, for example, motors and 
heating devices. Although the operation of such devices under normal conditions does 
not pose undue risk, there are circumstances in which such devices must be reliably 
disabled so as not to pose risks to human beings or other devices. 

[0003] For example, high power motors often rotate at high speeds and/or provide 
significant torques that in certain situations could pose risks to human beings or other 
devices that come into contact with the motors themselves or with other devices coupled 
to those motors. In particular, when such motors or devices coupled to those motors are 
replaced, fixed, modified, tested or otherwise operated upon by human beings such as 
engineers or service technicians, it is desirable that the motors be reliably disabled such 
that the motors cease to rotate or deliver sustained torque. 

[ 0004 ] In view of the possible hazards associated with high power devices 
generally, many modern industrial and other facilities employ various electronic and other 
technologies that reduce the risk of accidents and enhance overall system safety. 
Additionally, standards have been developed with a goal of further reducing the risk of 
accidents. For example, with respect to industrial facilities, standards from organizations 
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such as the NFPA, ISO, CEN, CENELEC, and the EC have been developed to establish 
requirements for safety. The technologies used to enhance system safety often are 
designed to comply with, or to assist in making a facility compliant with, standards from 
one or more of these organizations. 

[0005] Some of the technologies employed to enhance system safety are designed 
to reliably disable high power devices. For example, technologies such as high power 
contactors are often used to couple and decouple the driven devices to and from their high 
power drive circuits. Such contactors often include multiple, redundant high power 
contacts that are physically coupled to one another in such a way that, if one or more of 
the contacts become locked/welded in position, a signal is provided indicating that a fault 
has occurred. The signal can be, for example, the turning on of an indicator light at an 
operator interface or simply the failure of the high power device to start operating when 
commanded to do so. 

[0006] Such high power contactors are often used because of their relative 
technical simplicity and reliability. Nevertheless, high power contactors are 
disadvantageous insofar as they are relatively expensive, and physically large and bulky. 
Further, in certain circumstances, the disconnecting and connecting procedures for 
implementing these high power contactors can be complicated and/or time consuming. 
Consequently, the implementation of such high power contactors can negatively impact 
the overall efficiency of an industrial or other system in which the high power devices are 
employed. 

[0007 ] Because of these disadvantages, efforts have been made to find other 
mechanisms that could be used to disable high power devices. One alternate method of 
disabling a high power motor that has been attempted, for example, has involved 
disabling high power transistors of a drive circuit that deliver the high levels of power to 
the motor. However, this method has thus far proven to be insufficiently reliable. 
[0008] Therefore, it would be advantageous if a new mechanism could be 
developed that allowed for reliable disabling of high power devices such that the high 
power devices could not inadvertently start operating in a manner that might present a 
hazard. In particular, it would be advantageous if the new mechanism could avoid the 
disadvantages associated with using high power contactors in between the high power 
drive circuits and the driven devices, and at the same time was equally or even more 
reliable than such high power contactors (or other conventional technologies). Further, it 
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would be advantageous if the new mechanism was relatively easy and inexpensive to 
implement. 

SUMMARY OF THE INVENTION 
[0009] The present inventors have recognized that, in some circumstances, high 
power loads are satisfactorily disabled such that the loads stop moving or otherwise 
operating, regardless of whether high power levels of some sort continue to be provided to 
the loads. Indeed, in some of these circumstances, for example, the load is only capable 
of operating if it receives carefully controlled power levels that vary in time in addition to 
being of high magnitude. With this in mind, the present inventors have additionally 
recognized that in these circumstances it would be possible to disable the operation of the 
loads simply by ceasing to provide the control signals that govern the time-variation of the 
power. Further, the present inventors have recognized that, in situations where the drive 
circuits providing high power to their loads include both high power drive sections and 
low power logic sections that provide control signals to the high power drive sections to 
govern the delivery of power, the disabling of the loads can be achieved simply by setting 
the control signals of low power logic sections to low-level (or other disabling) values. 
[ 0010 ] In particular, the present invention relates to a drive circuit for delivering 
high-level power to a load. The drive circuit includes a high power circuit capable of 
being coupled to the load and delivering the high level power thereto, and a low power 
circuit that controls the high power circuit. The low power circuit includes a first circuit 
portion that provides at least one control signal that is at least indirectly communicated to 
the high power circuit and that controls the delivering of the high level power by the high 
power circuit, and a second circuit portions coupled to the first circuit portion. The 
second circuit portion is capable of disabling the first circuit portion so that the at least 
one control signal avoids taking on values that would result in the high power circuit 
delivering the high level power to the load. 

[0011] The present invention additionally relates to a high power drive circuit for 
delivering power to a motor. The high power drive circuit includes first means for 
delivering high power to the motor, second means for generating low power control 
signals for the first means, and third means for disabling the second means so that the low 
power control signals take on values that would tend to cause the first means to stop 
delivering the high power to the motor. 
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[0012 ] The present invention also relates to a method of stopping a high power 
load from operating, where the high power load receives power from a drive circuit 
having a high power drive section and a low power logic section, and where the low 
power logic section provides a control signal to the high power drive section and the high 
power drive section during normal operation provides the power to the high power load in 
response to the control signal. The method includes receiving a command to stop the high 
power load from operating, and switching a status of at least a first component of the low 
power logic section in response to the command. The switching of the status affects one 
of the first component and a second component of the low power logic section so that the 
control signal provided by the low power logic section takes on a value that would tend to 
cause the high power drive section to cease providing the power to the high power load. 
The method further includes ceasing to provide the power to the high power load in 
response to the control signal taking on the value. 

[0013] The present invention additionally relates to a drive circuit for delivering 
high-level power to a load. The drive circuit includes a high power circuit capable of 
being coupled to the load and delivering the high level power thereto, and a low power 
circuit that controls the high power circuit, where the low power circuit includes a first 
circuit portion that provides at least one control signal that is at least indirectly 
communicated to the high power circuit and that controls the delivering of the high level 
power by the high power circuit. Further, the first circuit portion is at least one of coupled 
to, and adapted to be coupled to, a second circuit portion that is capable of providing to 
the first circuit portion at least one additional signal causing the first circuit portion to 
become disabled so that the at least one control signal avoids taking on values that would 
result in the high power circuit delivering the high level power to the load. 



BRIEF DESCRIPTION OF THE DRAWINGS 
[0014 ] Fig. 1 is a schematic diagram of a first exemplary embodiment of a drive 
circuit coupled to a motor; 

[0015] Fig. 2 is a schematic diagram of a second exemplary embodiment of a 
drive circuit coupled to a motor; and 

[0016] Fig. 3 is a schematic diagram of a third exemplary embodiment of a drive 
circuit coupled to a motor. 
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DETAILED DESCRIPTION OF THE INVENTION 
[0017] Referring to FIG. 1, an exemplary drive circuit 10 for providing high levels 
of power to a motor 20 is shown. The drive circuit 10 includes a high power drive section 
30 and a low power logic section 40. The high power drive section 30 also can be termed 
a power structure, while the low power logic section 40 can be termed a control structure. 
[0018] As shown, first, second and third phases of power 32, 34 and 36, 
respectively, are delivered to the motor 20 from six power transistor devices 41-46. In the 
present embodiment, each of the power transistor devices 41-46 is an insulated gate 
bipolar transistor (IGBT) although, in alternate embodiments, other types of power 
transistor devices (or other, non-transistor power delivery devices) can be used. Each of 
the first, second and third phases 32, 34 and 36 receives voltage from a respective pair of 
the power transistor devices 41-42, 43-44, and 45-46, respectively. Current flows toward 
or away from the motor 20 in each phase 32, 34, 36 depending upon which of the pair of 
corresponding power transistor devices is switched on. If neither of the power transistor 
devices of a given pair is on, no current flows toward or away from the motor in the 
corresponding phase. First, second and third coils 50, 52 and 54, respectively, are 
coupled in series between the motor 20 and each of the respective pairs of power 
transistor devices 41-42, 43-44 and 45-46. By virtue of the first, second and third coils 
50, 52 and 54, the respective currents in each of the respective first, second and third 
phases 32, 34 and 36 can be sensed using conventional current sensing componentry (not 
shown). 

[ 0019 ] Each of the power transistor devices 41-46 is electrically isolated from the 
remainder of the high power drive section 30 and the low power logic section 40. 
However, the switching on and off of the power transistor devices 41-46 is nevertheless 
governed by signals coming from the remainder of the high power drive section 30. As 
shown, the power transistor devices 41-46 are light sensitive devices that respond to light 
signals given off by six optocoupler photodiodes 61-66, respectively. The six 
photodiodes 61-66 are turned on and off based upon six control signals provided from the 
low power logic section 40, which are respectively provided by six control line outputs 
71-76 of the low power logic section 40. More specifically, the six photodiodes 61-66 are 
themselves grouped into three pairs of photodiodes 61-62, 63-64 and 65-66. The 
photodiodes of each of the pairs are coupled in parallel with one another in opposite 
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orientations, and the nodes linking the two photodiodes of each pair are then coupled to 
respective ones of the control line outputs 71-76 by way of respective resistors 70. 
Although shown as part of the high power drive section 30, the resistors 70 and 
photodiodes 61-66 are low power devices; they are considered to be part of the high 
power drive section insofar as they are in direct communication with the high power 
transistor devices 41-46, and insofar as in practice the photodiodes are typically (though 
not necessarily) mounted on the same circuit board as the power transistor devices rather 
than on a separate circuit board supporting the low power logic section. Depending upon 
the embodiment, the respective photodiodes 61-66 are devices that are physically separate 
from the respective power transistor devices 41-46 or, alternately, the respective 
photodiodes are packaged along with their corresponding power transistor devices 41-46 
in an integrated manner. 

[0020] Further as shown in FIG. 1 , the low power logic section 40 includes a 
microprocessor 80 that is coupled to a hex inverter with open collector output 90, which 
in turn is connected to an octal tri-state buffer/line driver 100. The driver 100 outputs the 
control signals on the control line outputs 71-76 in response to six inverter signals 
provided by the hex inverter 90 on six inverter signal lines 91-96. The six inverter signals 
on lines 91-96 are provided by the inverter 90 in response to six microprocessor signals 
output by the microprocessor 80 on six microprocessor signal lines 81-86. Each of the 
microprocessor signal lines 81-86 is coupled not only to a respective input terminal on the 
hex inverter 90 but also is coupled to a power supply 99 by way of a respective pull-up 
resistor 98. The power supply 99 is also coupled to the microprocessor 80 to provide 
power thereto. In the present embodiment, the power supply for the low power logic 
section 40 is a positive 5 volt DC power supply, and each of the pull-up resistors 98 is a 
10 kft resistor. The hex inverter 90 essentially consists of six inverter components 97, 
each of which inverts a respective one of the microprocessor signals provided by way of 
lines 81-86 to produce the inverter signals provided on lines 91-96, respectively. 
[0021] During normal operation, the driver 100 merely acts as a buffer between 
the inverter signal lines 91-96 and the control line outputs 71-76. That is, the signal level 
of each respective control line output 71-76 is the same as the signal level of the 
corresponding inverter signal line 91-96. The buffering performed by the driver 100 is 
provided by way of six buffer components 102 within the line driver 100, each of which is 
coupled respectively between a respective one of the control line outputs 71-76 and its 
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corresponding inverter signal line 91-96. Further, because during normal operation the 
inverter 90 merely inverts the signals output by the microprocessor 80 along lines 81-86, 
the signals output by the driver 100 on the control line outputs 71-76 during normal 
operation have values that are opposite/inverted relative to the values of the signals on the 
lines 81-86. 

[0022] The driver 100 does not, however, output signals on lines 71-76 that are 
the same as those on lines 91-96 and inverted relative to those on lines 81-86 in all 
circumstances. Rather, the driver 100 only outputs the correct signals on lines 71-76 in 
response to the inverter signals on lines 91-96 if three conditions are met. First, power 
must be provided to the driver 100. Second, each of the lines 91-96 is coupled to a 
respective pull-up resistor 104, and each of these pull-up resistors must in turn be 
provided with power. In the embodiment shown, the power supply to which the resistors 
104 are coupled can again be a positive 5 volt DC power supply, and each of the pull-up 
resistors 104 can have a value of 4.7 kft. Third, power must be provided to an enable 
input 106 of the driver 100, which in turn results in the enabling of each of the buffer 
components 102. If any of these conditions are not met, the driver 100 ceases to 
consistently provide signals on lines 71-76 that are the same as the signals on lines 91-96 
and inverted relative to the signals on lines 81-86, and instead the signals output by the 
driver each take on a zero value or effectively-zero value in which no current is conducted 
to any of the photodiodes 61-66. 

[0023] The failure to meet any one of these conditions results in the control line 
outputs 71-76 being nonconductive for the following reasons. If the power supply is 
decoupled from the pull-up resistors 104, then currents will not flow through those 
resistors 104 when the inverter signal lines 91-96 take on a zero value. Further, because 
the inverter 90 is an open collector output device, the absence of power being supplied to 
the pull-up resistors 104 causes the six inverter components 97 of the inverter to enter 
high impedance, indeterminate states. While the inverter components 97 are in these 
indeterminate states, they are unable to take on high voltage values, and consequently, the 
lines 91-96 and input terminals of the buffer components 102 of the driver 100 remain at 
zero volts. Likewise, if the power supply 99 is entirely decoupled from the driver 100 
itself, the buffer components 102 are unable to output nonzero currents on the control 
output lines 71-76. Further, if a zero voltage level is applied to the enable input 106 of 
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the driver 100, then each of the buffer components 102 likewise is unable to provide a 
nonzero current on any of the control output lines 71-76. 

[0024] In accordance with one embodiment of the present invention, these 
features of the low power logic section 40 are employed to provide two redundant 
mechanisms for shutting down the low power logic section such that none of the power 
transistor devices 41-46 is commanded by any of the photodiodes 61-66 to deliver high 
power to the motor 20. Specifically, a first mechanism for shutting down the low power 
logic section 40 involves a safety relay circuit 110 that governs whether the power supply 
99 is coupled to each of the pull-up resistors 104 as well as to the driver 100 itself. As 
shown, the safety relay circuit 1 10 includes a safety on input 1 12 that includes a coil 114. 
So long as a predetermined voltage level is applied across the coil 1 14 (for example, 24 
volts), a normally-open contact 116 within the safety relay circuit 1 10 is closed and a 
second, normally-closed contact 118 within the safety relay circuit is opened. The closing 
of the normally-open contact 116 links first and second ports 120, 122 of the safety relay 
circuit 1 10 so that the power supply 99, which is coupled to the first port 120, is in turn 
coupled to the pull-up resistors 104 and the driver 100 itself, each of which are coupled to 
the second port 122. However, if the necessary voltage is no longer applied across the 
coil 114, then the power supply 99 is decoupled from both the pull-up resistors 104 and 
the driver 100 itself, thus causing the control output lines 71-76 to shut off and provide no 
voltage. Therefore, by applying or not applying a voltage across the coil 1 14 of the safety 
relay circuit 1 10, an operator can thereby determine whether the signals on control line 
outputs 71-76 reflect the microprocessor signals on lines 81-86 to provide normal control 
of the motor 20, or take on null values such that the power transistor devices 41-46 do not 
provide voltage to the motor 20. 

[0025] The present embodiment is further designed to allow for the detection of 
faults in the safety relay circuit 1 10. Specifically, a safety on monitor can also be coupled 
to third and fourth ports 124, 126 of the safety relay circuit 110, between which is coupled 
the normally-closed contact 1 18. The safety relay circuit 1 10 is configured such that the 
normally-open contact 1 16 and normally-closed contact 1 18 are physically coupled so that 
only one or the other of the contacts can be closed at any given time. Consequently, if the 
voltage applied across the coil 1 14 is turned off and the normally-open contact 1 16 
remains closed, then the normally-closed contact 118 remains open and thus the safety on 
monitor can determine that a fault has occurred due to the open-circuiting of the third and 
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fourth ports 124, 126 and the information that the voltage has been disconnected from the 
coil 1 14. Conversely, if the normally-closed contact 118 becomes welded, then the 
normally-open contact 1 16 cannot close despite the providing of voltage across the coil 
1 14, and consequently the driver 100 cannot provide nonzero signals on the control line 
outputs 71-76. 

[ 0026 ] In addition to the control capability provided by way of the safety relay 
circuit 1 10 in terms of controlling whether power is provided to the pull-up resistors 104 
and to the driver 100, the embodiment of Fig. 1 also includes additional logic circuitry 
130 that determines whether the enable input 106 of the driver 100 is asserted. As shown, 
the additional logic circuitry 130 includes a hardware switch 132 that is coupled between 
ground 134 (which is also coupled to appropriate grounding terminals on the 
microprocessor 80, the inverter 90 and the driver 100) and a low-true input 136 of a NOR 
gate 138. A second low-true input 140 of the NOR gate 138 is coupled to the 
microprocessor 80 by way of a control line 142, such that the microprocessor can also 
provide an input to the NOR gate. The output of the NOR gate 138 is coupled to a buffer 
component 144, which in turn is coupled to the enable input 106 and also to a further 
pull-up resistor 146. The further pull-up resistor 146 is coupled to the power supply 99 by 
way of the same line as the other pull-up resistors 104, such that power is only supplied 
when the normally-open contact 1 16 of the safety relay circuit 1 10 is closed. The buffer 
144 acts as an open collector output such that a positive, non-zero output can only be 
applied to the enable input 106 of the driver 100 if power is supplied to the pull-up 
resistor 146, that is, only if the normally-open contact 1 16 of the safety relay circuit 1 10 is 
closed. 

[0027] Given this design, the enable input 106 only receives a positive, non-zero 
value such that the driver 100 is capable of outputting non-zero output signals on the 
control line outputs 71-76 if the normally-open contact 1 16 of the safety relay circuit 1 10 
is closed and at least one of the hardware switch 132 is closed or the microprocessor 80 
provides a zero-level control signal via the control line 142 to the inverter 140. Thus, 
even if the safety relay circuit 1 10 is actuated such that power is provided to each of the 
driver 100 and the pull-up resistors 104, 146, it is possible for either of the 
microprocessor 80 or an operator, by way of opening the switch 1 32, to disable the driver 
100 such that each of the control line outputs 71-76 takes on a zero or effectively-zero 
level. 
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[0028] When implemented as shown in FIG. 1, the drive circuit 10 provides 
multiple, redundant avenues by which an operator or other control entity can cause the 
drive circuit to provide zero-level control signals via the control line outputs 71-76 to the 
photodiodes 61-66 such that the motor 20 ceases to receive power from the power 
transistor devices 41-46. While it is possible that a human operator may trigger one or 
both of the hardware switch 132 or the safety on input 1 12 of the safety relay circuit 1 10, 
the present embodiment also envisions the coupling of these inputs to other components 
such as an additional safety relay circuit that would be capable of providing a command to 
each of these inputs (such a safety relay circuit could, for example, be present in a factory 
environment). That is, the present embodiment is intended to be capable of being 
implemented in conjunction with a variety of other devices in a manner allowing those 
other devices to control whether the drive circuit 10 is disabled. 
[ 0029 ] The circuitry of the drive circuit 10 also is sufficiently redundant that it 
satisfies requirements of Category 3 of the EN 954-1 standard, which requires that no 
single fault in any part of the drive circuit 10 would lead to a loss of the ability to cease 
providing control signals such that the motor 20 might develop sustained torque. As 
discussed above, a failure of one of the contacts of the safety relay circuit 110 can be 
detected by way of the safety on monitor. In the case of the actuation of the switch 132 or 
a microprocessor command provided by way of the control line 142, a failure of the 
signals on control line outputs 71-76 to become null in response to such 
activation/command can be sensed by way of the coils 50, 52 and 54. That is, if the 
switch 132 is open, or the microprocessor 80 is providing a zero-level signal on the 
control line 142, then none of the coils 50, 52, 54 should experience any current and, if 
current is sensed, a warning signal is generated. In certain embodiments, the sensed 
current information obtained by way of the coils 50, 52 and 54 is provided to and used by 
the microprocessor 80. 

[0030] The fact that the drive circuit 10 satisfies Category 3 of the EN 954-1 
standard is not meant to indicate that the drive circuit 10 guarantees that electrical voltage 
is not provided to the motor 20. Indeed, despite the nullification of the control line 
outputs 71-76, it is still conceivable that one or more of the power transistor devices 41- 
46 would apply voltage to the motor 20. Rather, because the motor 20 can only develop 
sustained rotation and torque if the power transistor devices 41-46 apply voltage at 
specific times in a pulse width modulated (PWM) manner determined by the 
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microprocessor 80, inadvertent conduction of currents by any of the power transistor 
devices 41-46 would only, at most, cause the motor to experience a one-time movement 
of a limited number of degrees, such as 180 degrees for a two-pole motor or 90 degrees 
for a four-pole motor. If the motor 20 is running when either the safety on input 1 12 is 
triggered or the enable input 106 receives a low level signal due to the triggering of the 
switch 132 or a signal from the microprocessor 80, the motor 20 will coast to a standstill. 
The safety relay circuit input to the driver 100 prevents power from being provided to the 
control line outputs 71-76, while the actuation of the enable input 106 of the driver 100, 
as actuated by the switch 132 or the microprocessor 80 by way of the control line 142, 
acts as a logic inhibit of the control line outputs. 

[0031] Turning to FIG. 2, an alternate embodiment of a drive circuit 210 that 
somewhat differs from the drive circuit 10 of FIG. 1 is shown coupled to the motor 20. 
The drive circuit 210 does include the same high power drive section 30 as the drive 
circuit 10, and a low power logic section 240 of the drive circuit includes the same 
microprocessor 80, inverter 90, pull-up resistors 98, 104 and 146, and additional logic 
circuitry 130 as the low power logic section 40. As in the case of drive circuit 10, the 
additional logic circuitry 130 provides signals to an enable input 106 of an octal tri-state 
buffer/line driver 200 of the logic circuit 240. However, the logic circuit 240 differs from 
the logic circuit 40 in that the driver 200 of the logic circuit 240 is not coupled to the 
power supply 99 by way of any safety relay. Further, a safety relay circuit 310 that is 
employed in the low power logic section 240 is essentially an inverted version of the 
safety relay circuit 1 10. Namely, the safety relay circuit 310 includes first and second 
ports 320 and 322 that are respectively coupled to the ground 134 and to the pull-up 
resistors 104 and 146, with a normally-closed contact 316 coupled between those ports. 
Also, third and fourth ports 324 and 326 of the safety relay circuit 310 have a normally- 
open contact 318 coupled between them. Further, the power supply 99 is coupled to the 
pull-up resistors 104 and 146 and to the second port 322 by a low-level resistance (in this 
example, a 330 ohm resistor). 

[ 0032 ] Consequently, when a safety on input is provided to the safety relay circuit 
310 such that a coil 312 within the safety relay circuit is actuated, the normally-closed 
contact 316 is opened such that the power supply 99 is effectively connected to the pull- 
up resistors 104, 146, thereby allowing the driver 200 to receive non-zero signals from the 
inverter 90. However, when the safety on input is not provided to the safety relay circuit 
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310, the pull-up resistors 104 and 146 are coupled to ground, thereby preventing the 
driver 200 from outputting non-zero signals on the control line outputs 71-76. As in the 
case of the safety relay circuit 1 10, the normally-closed contact 316 and normally-open 
contact 318 of the safety relay circuit 310 are physically coupled such that only one of the 
contacts can be closed at any given time, such that a welding of either of the normally- 
closed and normally-opened contacts can be detected. In comparison with the drive 
circuit 10 of FIG. 1, the drive circuit 210 of FIG. 2 is somewhat simpler to implement and 
for that reason is somewhat preferred for that reason, albeit the embodiment of FIG. 1 
satisfies certain standards that may not be satisfied by the circuit of FIG. 2. 
[0033] Referring to FIG. 3, yet a third embodiment of the present invention shows 
a drive circuit 410 having components identical to the drive circuit 1 10 except insofar as 
the safety relay circuit 1 10 has been replaced with a circuit 400 that includes a DC-to-DC 
conversion circuit 420. In this embodiment, it is envisioned that another device (not 
shown) such as another safety relay circuit provided by a third party would be coupled to 
input terminal 412 of the circuit 400. The circuit would then convert power signals 
provided by that other device into an output signal 415 that would govern the voltage 
applied to the pull-up resistors 104, 146 and the power supplied to the driver 100. By 
using a DC-to-DC conversion circuit such as that shown, the input signals at the input 
terminal 412 would be isolated from the output signal 415, and the input signals could 
differ in their voltage range from that required by the driver 100 in an arbitrary manner (in 
the embodiment shown, for example, the input signals 412 can range from 0 to 12 Volts 
signals, while the output signal 415 can range from 0 to 5 Volts). Although the 
embodiment of FIG. 3 shows a DC-to-DC conversion circuit that provides electrical 
isolation, in alternate embodiments, opto-isolators or other devices could be employed to 
provide isolation. A DC-to-DC conversion device is advantageous insofar as it provides a 
reliable shut-down mechanism since it cannot operate without power being applied. 
[0034] Although three embodiments of the present invention are shown in FIGS . 
1-3, the present invention is not intended to be limited to these particular electrical 
circuits. Rather, the present invention is intended to encompass a variety of electrical and 
other control circuits in which the delivery of high power levels to a high power device is 
governed in part by low power circuitry, and in which there are one or more control 
mechanisms for disabling the low power circuitry to effectively stop the operation of the 
high power device without taking any action to disable or disconnect the high power drive 
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circuit devices that are directly coupled to that high power load. Indeed, the present 
invention is intended to encompass any such dual-stage drive circuits in which 
disablement occurs via the low power stage, regardless of the type of high power load that 
those drive circuits are powering. 

[0035] Also, the present invention is intended to encompass control/drive circuits 
that are formed from multiple distinct modules. For example, with respect to the 
embodiment of FIG. 2, all of the components of the drive circuit 210 need not be included 
on a single circuit board. Rather, in some embodiments, all of the low power logic circuit 
240 of the drive circuit 210 of FIG. 2 would be included within a primary module except 
for the safety relay circuit 310, which could be implemented on an auxiliary module. In 
such an embodiment, the drive circuit 210 could be operated to control the high power 
drive circuit 30 and the motor 20 as normal without the auxiliary module. However, if the 
auxiliary module were coupled to the primary module (e.g., by way of appropriate 
connectors/adaptors), then it would be further possible to disable the drive circuit as 
discussed above by providing the safety on input and thereby coupling the pull-up 
resistors 104, 146 to the ground. A similar design could be employed in relation to the 
embodiments of FIGS. 1 and 3, particularly if a jumper was used to couple the pull-up 
resistors 104,146 and power input of the driver 100 to a power supply in the absence of 
the safety relay circuit 1 10 or the circuit 400. An auxiliary module including a safety 
relay circuit or other circuit such as circuits 1 10,310 and 400 could be implemented in a 
variety of manners, such as on a plug-in-module or as part of an external cable. Thus, the 
present invention is intended to encompass embodiments in which a main control device 
can be coupled to one or more other devices, which depending upon the embodiment 
might be required or optional (or even after-market) devices. 
[0036] Although the terms "safety", "reliable", "safety system", "safety 
controller", and other related terms may be used herein, the usage of such terms is not a 
representation that the present invention will make an industrial or other process safe or 
absolutely reliable, or that other systems will produce unsafe operation. Safety in an 
industrial or other process depends on a wide variety of factors outside of the scope of the 
present invention including, for example: design of the safety system; installation and 
maintenance of the components of the safety system; the cooperation and training of 
individuals using the safety system; and consideration of the failure modes of the other 
components being utilized. Although the present invention is intended to be highly 
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reliable, all physical systems are susceptible to failure and provision must be made for 
such failure. 

[ 0037 ] The above description has been that of a preferred embodiment of the 
present invention. It will occur to those that practice the art that many modifications may 
be made without departing from the spirit and scope of the invention. In order to apprise 
the public of the various embodiments that may fall within the scope of the invention, the 
following claims are made. 
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